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DETAILED ACTION 

Acknowledgements 

1 . This communication is in response to the original Application No. 10/574,808 
filed on January 30, 2007. 

2. Claims 1 -3, 5-7, 11-12,17,1 9-20, 22-23, 25, 27, 30-34, 36-39, 52-54, 56-58, 61 , 
66, 68-69, 71-72, 74, 76, 79-83 and 85-88 are currently pending and have been fully 
examined. 

3. Claims 4, 8-1 0,13-16,18,21, 24, 26, 28-29, 35, 40-51 , 55, 59-60, 62-65, 67, 70 
73, 75, 77-78, 84 and 89-129 have been withdrawn from consideration by the 
Applicant. 

4. For the purpose of applying the prior art, PreGrant Publications will be referred to 
using a four digit number within square brackets, e.g. [0001]. 

Election/Restrictions 

5. Applicant's election, without traverse, of claims 1 -3, 5-7, 1 1 -1 2, 1 7, 1 9-20, 22-23, 
25, 27, 30-34, 36-39, 52-54, 56-58, 61, 66, 68-69, 71-72, 74, 76, 79-83, 85-88 in the 
reply filed on March 17, 2009 is acknowledged. 

Priority 

6. Priority for this application is set to October 1 0, 2003, the filing date of the 
Foreign Application #: 0323836.7. 

7. The later-filed application must be an application for a patent for an invention 
which is also disclosed in the prior application (the parent or original non-provisional 
application or provisional application). The disclosure of the invention in the parent 
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application and in the later-filed application must be sufficient to comply with the 
requirements of the first paragraph of 35 U.S.C. §1 1 2. 1 
Specification 

8. Objection to the Specification is being made. The title of the invention is not 
sufficiently descriptive. A new title is required that is clearly indicative of the invention to 
which the claims are directed. The following title is suggested: "User authentication in a 
mobile telecommunication system." 

Claim Rejections - 35 USC § 101 

9. 35 U.S.C. §101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

1 0. Claims 1 -3, 5-7, 11-12,17,1 9-20, 22-23, 25, 27, 30-34, 36-39, 52-54, 56-58, 61 , 
66, 68-69, 71-72, 74, 76, 79-83 and 85-88 are rejected under 35 U.S.C. §101 because 
the claimed invention is directed to non-statutory subject matter. 

Based on Supreme Court precedent 2 and recent Federal Circuit decisions, a 
§101 process must (1) be tied to another statutory class (such as a particular 
apparatus) or (2) transform the underlying subject matter (such as an article or 



See Transco Products, Inc. v. Performance Contracting. Inc., 38 F.3d 551, 32 USPQ2d 1077 (Fed. Cir. 1994). 



2 Diamond v. Diehr, 450 U.S. 175, 209 USPQ 1 (1981); Parker v. Flook, 437 U.S. 584, 588 n.9 (1978); 
Gotsschalk v. Benson, 409 U.S. 63, 70, 71 (1972); Cochrane v. Deener, 94 U.S. 780, 787-88 (1876). The 
Supreme Court recognize that this test is not necessarily fixed or permanent and may evolve with 
technological advances; 
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materials) to a different state or thing. In addition, the tie to a particular apparatus, for 
example, cannot be mere extra-solution activity. - 

An example of a method claim that would not qualify as a statutory process 
would be a claim that recited purely mental steps. 

To meet prong (1), the method step should positively recite the other statutory 
class (the thing or product) to which it is tied. This may be accomplished by having the 
claim positively recite the machine that accomplishes the method steps. Alternatively or 
to meet prong (2), the method step should positively recite identifying the material that is 
being changed to a different state or positively recite the subject matter that is being 
transformed. 

In this particular case, claim 1 fails prong (1) because there exist no "tie" to 
another statutory class (such as a particular apparatus) to perform the following steps 
of: 

the entity generates transaction data... 
at least during the authentication process... 
the method includes the step... 
wherein in order to authenticate... 

Therefore, claim 1 does not meet the requirements of the first prong (1). 
Additionally, the claim(s) 1 fail prong (2) because the method steps do not 
transform the underlying subject matter to a different state or thing 



3 See In re Bilski, 88 USPQ2d 1385 (Fed. Cir. 2008); 
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Claims 2-3, 5-7, 11-12, 17, 19-20, 22-23, 25, 27, 30-34 and 36-39 are also 
rejected for being dependent upon rejected claim 1 . The appropriate correction is 
required. 

As to claim 52, is also rejected for appearing to be a Hybrid claim (a claim 
containing a mixed subject matter) 4 The appropriate correction is required. 

Claims 53-54, 56-58, 61 , 66, 68-69, 71-72, 74, 76, 79-83 and 85-88 are also 
rejected for being dependent upon rejected claim 52. The appropriate correction is 
required. 

Claim Rejections - 35 USC § 112, 2 nd 

11. The following is a quotation of the second paragraph of 35 U.S.C. §112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

12. Claims 52-54, 56-58, 61 , 66, 68-69, 71 -72, 74, 76, 79-83 and 85-88 are rejected 
under 35 U.S.C. §1 12, second paragraph, as being indefinite for failing to particularly 
point out and distinctly claim the subject matter which applicant regards as the 
invention. 

As to claim 52, it is considered to be a Hybrid claims since a person of ordinary 
skill in the art would recognize that the claim encompasses at least two statutory 
classes of invention. Evidence that Claim 1 recites an apparatus includes: The 
limitation beginning ("Data processing apparatus..."), dependent Claim 53, which begins 
"Apparatus according to claim 52...." Evidence to support a construction that the claim 
is drawn to a method includes "...each for storing predetermined authentication 



4 MPEP §2173.05(p)ll 
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information relating to the carrying out of an authentication process for authenticating a 
transaction with an entity by means... to generate transaction data relating to the 
transaction,... authentication process being carried out by authentication means... and 
involving the use of the predetermined authentication... in order to authenticate the 
transaction, the transaction data is transmitted between the data...." Because of the 
conflicting evidence, the claim is considered a Hybrid claim and the appropriate 
correction is required. 

Claims 53-54, 56-58, 61, 66, 68-69, 71-72, 74, 76, 79-83 and 85-88 are also 
rejected for being dependent upon rejected claim 52. The appropriate correction is 
required. 

As to claims 22 and 71 , Applicant recites, "...comprising using said carrier to 
obtain security data independently of the data processing apparatus, and analysing the 
security data for determining whether to allow access to the predetermined 
information..." However, it is unclear which security data the Applicant is referring to. 
One of ordinary skill in the art would not be reasonably apprised of the scope of the 
invention. The appropriate correction is required. 

As to claims 36 and 85, Applicant recites, "...including routing communications 
between the authentication storage means and the system via the transaction 
manager." However, it is unclear which "system" the Applicant is referring to. One of 
ordinary skill in the art would not be reasonably apprised of the scope of the invention. 
The appropriate correction is required. 
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As to claims 37 and 86, Applicant recites, "...wherein the transaction manager is 
implemented by the data processing apparatus." However, it is unclear what the 
Applicant means by, implemented . One of ordinary skill in the art would not be 
reasonably apprised of the scope of the invention. The appropriate correction is 
required. 

Claims 1-3, 5-7, 11-12, 17, 19-20, 22-23, 25, 27, 30-34, 36-39, 52-54, 56-58, 61, 
66, 68-69, 71-72, 74, 76, 79-83 and 85-88 rejected as failing to define the invention in 
the manner required by 35 U.S.C. §112, second paragraph. 

The claim(s) are narrative in form and replete with indefinite and functional or 
operational language. The structure which goes to make up the device must be clearly 
and positively specified. The structure must be organized and correlated in such a 
manner as to present a complete operative device. The claim(s) must be in one 
sentence form only. Note the format of the claims in the patent(s) cited. 

Claim Rejections - 35 USC § 102 

1 3. The following is a quotation of the appropriate paragraphs of 35 U.S.C. §1 02 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1 ) an application for patent, published under section 1 22(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

14. Claims 1 -3, 5-7, 1 2, 52-54, 56-58, 61 , 36-39 and 85-88 are rejected under 35 
U.S.C. §1 02(e) as being anticipated by Malinen etal. . (US 2003/0028763) C Malinen "). 
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Malinen expressly teaches: 

the entity generates transaction data relating to the transaction (See at least 
Abstract, [0005]-[0007], [0070]-[0074]), and 

at least during the authentication process the data processing apparatus has 
operatively associated with it a selected one of a plurality of authentication 
storage means each for storing predetermined authentication information (See at 
least Abstract, [0006], [0009], [0011], [0016], [0067]), 

the authentication storage means being registerable with a common system (See 
at least [0157], [0180]), 

the method including the step of carrying out the authentication process via a 
communications link with that system, the authentication process being carried 
out by authenticating means incorporated in the system and involving the use of 
the predetermined authentication information stored by the selected one 
authentication storage means and the transaction data (See at least Abstract, 
[0006], [0009], [0011], [0016], [0076], [0079], Figure 8-10), 

wherein in order to authenticate the transaction, the transaction data is 
transmitted between the data processing apparatus and the system via a 
transaction manager implemented by the data processing apparatus, and the 
predetermined authentication information is also transmitted between the 
authentication storage means and the system via the transaction manager (See 
at least Abstract, [0006]-[0007], [0009], [0011], [0023], [0070]-[0074]). 

As to claims 2 and 53: 

Malinen expressly teaches: 

in which the predetermined authentication information stored by each 
authentication storage means corresponds to information which is used to 
authenticate a user of that authentication storage means in relation to the system 
(See at least Abstract, [0009], [001 1], [0067]). 

As to claims 3 and 54: 

Malinen expressly teaches: 

wherein the system is a telecommunications system (See at least [0010], [0023], 
[0067], [0080], [0083], [0175]). 
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As to claim 4: 
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(Cancelled) 
As to claims 5 and 56: 

Malinen expressly teaches: 

wherein each user is authenticated in the telecommunications system by means 
of the use of a smart card or subscriber identity module (e.g. SIM), and in which 
the authentication storage means respective to that user corresponds to or 
simulates the smart card for that user (See at least [0024], [0067], [0074], [0080], 
[0084]). 

As to claims 6 and 57: 

Malinen expressly teaches: 

wherein the smart card or SIM authenticates the transaction when the smart card 
or SIM is operable in a terminal usable in a mobile and/or cellular 
telecommunications system (See at least Abstract, [0006], [0009], [001 1], [0067], 
[0074], [0080]). 

As to claims 7 and 58: 

Malinen expressly teaches: 

wherein the smart card or SIM is operable to authenticate the terminal in the 
mobile and/or cellular telecommunications system (See at least Abstract, [0006], 
[0009], [001 1], [0067], [0074], [0080]). 

As to claims 8-10: 

(Cancelled) 
As to claims 12 and 61: 

Malinen expressly teaches: 

in which the authentication process involves the sending of a message and the 
generation of a response dependent on the message and the predetermined 
information (See at least [0011], [0062], [0074], [0081], [0085], [0088], Figure 3, 
6, 10). 
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As to claims 13 - 16. 18. 21. 24. 26. 28-29. 35. 40-51 

Have been canceled by the Applicant. 

As to claims 36 and 85: 

Malinen expressly teaches: 

including routing communications between the authentication storage means and 
the system via the transaction manager (See at least [0009], [001 1], [0074]). 

As to claims 37 and 86: 

Malinen expressly teaches: 

wherein the transaction manager is implemented by the data processing 
apparatus (See at least [0009], [0011], [0074]). 

As to claims 38 and 87: 

Malinen expressly teaches: 

wherein the transaction manager detects the operative coupling of the 
authentication storage means (See at least [0080]-[0082], [0084]-[0085], Figure 
1)- 

As to claims 39 and 88: 

Malinen expressly teaches: 

wherein the transaction manager transmits data relating to an authenticated 
transaction to the entity to which that transaction relates (See at least [0084]- 
[0086], [0088], [0095]-[0097], [0101]-[0104]). 
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Claim Rejections - 35 USC § 103 

1 5. The following is a quotation of 35 U.S.C. §1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

16. Claims 11 is rejected under 35 U.S.C. §1 03(a) as being unpatentable over 
Malinen. 

As to claims 11: 

Malinen discloses as discussed above; however, Malinen does not expressly teach: 

in which the authentication storage means is incorporated on a data carrier for 
data or software for use by that data processing apparatus. 

However, incorporating an authentication storage means on a data carrier is an attribute 

for the data carrier. Incorporating an authentication storage means on a data carrier is 

old and well known in the art. 

1 7. Claims 1 7, 1 9-20, 22-23, 25, 27, 66, 68-69, 71 -72, 74 and 76 are rejected under 
35 U.S.C. §1 03(a) as being unpatentable over Malinen and in view of Tavloe , (US 
5,933,785) (" Tavloe "). 

As to claims 17 and 66: 

Malinen discloses as discussed above; however, Malinen does not expressly teach: 
including operatively coupling the authentication storage means to a carrier. 
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However, 7a Woe expressly teaches: 

including operatively coupling the authentication storage means to a carrier (See 
at least Abstract, Figure 2-3) 

Therefore, it would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify Malinen to include the features of Tayloe because including a 
authenticating storage means in a carrier provides protection for it. 

As to claims 19 and 68: 

Malinen discloses as discussed above; however, Malinen does not expressly teach: 

wherein the carrier is operatively coupled to the data processing apparatus by a 
wireless link. 

However, Tayloe expressly teaches: 

wherein the carrier is operatively coupled to the data processing apparatus by a 
wireless link (See at least (Col. 4, lines 45-65)). 

Therefore, it would have been obvious to one of ordinary skill in the art at the time of the 

invention to modify Malinen to include the features of TaWoe because having a carrier 

coupled to a apparatus via a wireless link provides for efficient and easy access to 

processing apparatus. 

As to claims 20 and 69: 

Malinen discloses as discussed above; however, Malinen does not expressly teach: 
wherein the authentication storage means is removably coupled to the carrier. 
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However, Tavloe expressly teaches: 
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wherein the authentication storage means is removably coupled to the carrier 
(See at least Abstract, (Col. 1, lines 14-21), (Col. 2, lines 59-67),(Col. 4, lines 1- 
17)). 

Therefore, it would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify Malinen to include the features of Tavloe because it may be desired 
to interchange authentication storage means with different carriers. 

As to claims 22 and 71 : 

Malinen discloses as discussed above; however, Malinen does not expressly teach: 

comprising using said carrier to obtain security data independently of the data 
processing apparatus, and analysing the security data for determining whether to 
allow access to the predetermined information. 

However, Tavloe expressly teaches: 

comprising using said carrier to obtain security data independently of the data 
processing apparatus, and analysing the security data for determining whether to 
allow access to the predetermined information (See at least (Col. 2, lines 59-67)). 

Therefore, it would have been obvious to one of ordinary skill in the art at the time of the 

invention to modify Malinen to include the features of Tavloe because it may be 

desirable to provide some type of security to ensure that only properly authorized user's 

have access to information on the SIM or smart card. 

As to claims 23 and 72: 

Malinen discloses as discussed above; however, Malinen does not expressly teach: 
wherein the security data is obtained by alphanumeric data entry means. 
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However, Tavloe expressly teaches: 



Page 14 



wherein the security data is obtained by alphanumeric data entry means (See at 
least (Col. 3, lines 15-22), (Col. 5, lines 55-60), Figure 1). 

Therefore, it would have been obvious to one of ordinary skill in the art at the time of the 

invention to modify Malinen to include the features of Tavloe because alphanumeric 

data entry allows for a well know method of inputting data which provides access to 

control information. 



As to claims 25 and 74: 

Malinen discloses as discussed above; however, Malinen does not expressly teach: 

wherein the security data comprises a Personal Identification Number (PIN) and 
the analysing step compares the PIN obtained by the security data entry means 
with a PIN stored on the authentication storage means and only allows access to 
the predetermined information when the respective PINs match. 



However, Tavloe expressly teaches: 

wherein the security data comprises a Personal Identification Number (PIN) and 
the analysing step compares the PIN obtained by the security data entry means 
with a PIN stored on the authentication storage means and only allows access to 
the predetermined information when the respective PINs match (See at least 
(Col. 2, lines 59-67)). 



Therefore, it would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify Malinen to include the features of Tavloe because it may be 
desirable to provide some type of security to ensure that only properly authorized user's 
have access to information on the SIM or smart card. 



USPTO 



Page 14 



5/4/2009 



Application/Control Number: 10/574,808 
Art Unit: 3685 

As to claims 27 and 76: 
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Malinen expressly teaches: 

wherein communication with the data processing apparatus is controlled by a 
data processing module (See at least Abstract, [0006]-[0007], [0009], [001 1]). 

18. Claims 30-34 and 79-83 are rejected under 35 U.S.C. §1 03(a) as being 
unpatentable over Malinen and in view of Tayloe and in further view of Schneier et al. , 
(US 2003/0177347) C Schneier "). 

As to claims 30 and 79: 

The combination of Malinen/Tayloe discloses as discussed above; however, the 

combination of Malinen/Tayloe does not expressly disclose: 

wherein the data processing module of the carrier decrypts encrypted data 
received from the data processing module of the data processing apparatus. 

However, Schneier expressly teaches: 

wherein the data processing module of the carrier decrypts encrypted data 
received from the data processing module of the data processing apparatus (See 
at least [0138]). 

Therefore, it would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the combination of Malinen/T ayloe to include the features of 
Schneier because it may be desirable to maintain data security by ensuring a 
decryption/encryption process is being employed between device communications with 
each other. 
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As to claims 31 and 80: 

The combination of Malinen/Tavloe discloses as discussed above; however, the 

combination of Malinen/Tavloe does not expressly disclose: 

wherein the data processing module of the carrier encrypts data transmitted to 
the data processing module of the data processing apparatus. 

However, Schneier expressly teaches: 

wherein the data processing module of the carrier encrypts data transmitted to 
the data processing module of the data processing apparatus (See at least 
[0138]). 

Therefore, it would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the combination of Malinen/Tavloe to include the features of 
Schneier because it may be desirable to maintain data security by ensuring a 
decryption/encryption process is being employed between device communications with 
each other. 

As to claims 32 and 81 : 

The combination of Malinen/Tavloe discloses as discussed above; however, the 

combination of Malinen/Tavloe does not expressly disclose: 

wherein the respective data processing modules comprise a key for allowing 
encryption and/or decryption of data. 

However, Schneier expressly teaches: 

wherein the respective data processing modules comprise a key for allowing 
encryption and/or decryption of data (See at least [0138]). 

Therefore, it would have been obvious to one of ordinary skill in the art at the time of the 

invention to modify the combination of Malinen/Tavloe to include the features of 

Schneier because it may be desirable to maintain data security by ensuring a 
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decryption/encryption process is being employed between device communications with 
each other. 

As to claims 33 and 82: 

The combination of Malinen/Tayloe discloses as discussed above; however, the 

combination of Malinen/Tavloe does not expressly disclose: 

wherein the key comprises a shared secret key for each of the respective data 
processing modules. 

However, Schneier expressly teaches: 

wherein the key comprises a shared secret key for each of the respective data 
processing modules (See at least [0212]). 

Therefore, it would have been obvious to one of ordinary skill in the art at the time of the 

invention to modify the combination of Malinen/T avloe to include the features of 

Schneier because it may be desirable to maintain data security by ensuring a 

decryption/encryption process is being employed between device communications with 

each other. 

As to claims 34 and 83: 

Malinen discloses as discussed above; however, Malinen does not expressly disclose: 

wherein the carrier is operatively coupled to a plurality of authentication storage 
means for respectively enabling the said authentication process and one or more 
other authentication processes. 

However, Tayloe expressly teaches: 

wherein the carrier is operatively coupled to a plurality of authentication storage 
means for respectively enabling the said authentication process and one or more 
other authentication processes (See at least Abstract, Figure 2-3) 

Therefore, it would have been obvious to one of ordinary skill in the art at the time of the 
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invention to modify Malinen to include the features of Tavloe because including a 
authenticating storage means in a carrier provides protection for it. 



19. Examiner's Note: The Examiner has pointed out particular references contained 
in the prior art of record within the body of this action for the convenience of the 
applicant. Although the specified citations are representatives of the teachings in the art 
and are applied to the specific limitations within the individual claim, other passages and 
figures may apply. Applicant, in preparing the response, should consider fully the entire 
reference as potentially teaching all or part of the claimed invention, as well as the 
context of the passage as taught by the prior art or disclosed by the Examiner. 



Conclusion 



20. The prior art made of record and not relied upon is considered pertinent to 
Applicant's disclosure. 

- Resneck , (US 2002/0002545); [0026] As shown in FIG. 1, a portable transaction device 10 is 
conveniently configured to be the size of a credit card that can fit easily into a pocket, a wallet, or 
a purse. The transaction device 10 has at least one, preferably more than one, storage medium 
for storing account access information that can be read by a reading device for accessing an 
anonymous account. For instance, the transaction device 10 includes one or more of a bar code 
12, a magnetic strip 14, a CD-ROM 16, a smart-card microprocessor 18 which may be provided 
with digital storage, and the like. The different storage media on the device 10 may contain the 
same or different information. The body of the transaction device 10 as shown is a shaped CR- 
ROM 16. The CD-ROM 16 may be a write-once read-only CD-R. The reading device for reading 
information stored in the storage media may be an optical scanner, a magnetic data reader, an 
electronic data reader, or the like. As such, the device 10 may be used in traditional brick-and- 
mortar establishments as well as in the virtual world of electronic commerce. 

Any inquiry concerning this communication or earlier communication from 

the examiner should be directed to Mr. Dante Ravetti whose telephone number is 

(571 ) 270-3609. The examiner can normally be reached on Monday - Thursday 
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9:00am-5:00pm. 

If attempts to reach examiner by telephone are unsuccessful, the 
examiner's supervisor, Mr. Calvin Hewitt may be reached at (571) 272-6709. The 
fax phone number for the organization where this application or proceeding is 
assigned is (571) 270-4609. 

Information regarding the status of an application may be obtained from 

the Patent Application Information Retrieval (PAIR) system. Status information 

for published applications may be obtained from either Private PAIR or Public 

PAIR. Status information for unpublished applications is available through 

Private PAIR only. For more information about the PAIR system see 

Iittp://pair»dirsct,uspto.gov. Should you have questions on access to the private 

PAIR system, please contact the Electronic Business Center (EBC) at 1-(866) 

217-9197. If you would like assistance from a USPTO Customer Service 

Representative or access to the automated information system, call 1-(800) 786- 

91 99 (IN USA or CANADA) or 1 -(571 ) 272-1 000. 

/Dante Ravetti/ 
Examiner, Art Unit 3685 
Thursday, April 23, 2009 

/Calvin L Hewitt II/ 

Supervisory Patent Examiner, Art Unit 3685 
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